gokalkan/wrapper.go at master · ncanode-kz/gokalkan · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
package gokalkan

import (
	"errors"
	"fmt"
	"sync"

	"github.com/ncanode-kz/gokalkan/ckalkan"
)

// Kalkan - это обертка над методами KalkanCrypt.
type Kalkan interface {
	LoadKeyStore(path, password string, alias ...string) (err error)
	LoadKeyStoreFromBytes(key []byte, password string, alias ...string) (err error)
	ListCertificateAliases() ([]string, error)

	Sign(data []byte, isDetached, withTSP bool) (signature []byte, err error)
	AddSigner(cms, data []byte, isDetached, withTSP bool) (signature []byte, err error)
	SignRaw(data []byte) (signature []byte, err error)
	VerifyRaw(data, signature []byte, cert string) (string, error)

	SignJWT(claims map[string]any, alg string) (string, error)
	VerifyJWT(token, cert string) (claims map[string]any, err error)

	SignPDF(pdfData []byte, opts PDFSignOptions) ([]byte, error)
	VerifyPDF(pdfData []byte) (allValid bool, signers []PDFSignerInfo, err error)
	SignXML(xml string) (signedXML string, err error)
	SignXMLWithOptions(xmlData string, opts XMLSignOptions) (string, error)
	SignWSSE(xml, id string) (signedXML string, err error)

	Verify(signature []byte) (string, error)
	VerifyXML(signedXML string) (string, error)
	VerifyWSSE(signedXML string) (string, error)
	VerifyDetached(signature, data []byte) (string, error)
	ExtractCMS(cms []byte) ([]byte, error)

	GetCertFromCMS(cms []byte, signID int) (string, error)
	GetCertFromXML(xml string, signID int) ([]byte, error)

	ValidateCert(cert string) (string, error)
	ValidateCertOCSP(cert string, url ...string) (string, error)
	ValidateCertCRL(cert, crlPath string) (string, error)

	X509CertificateGetInfo(inCert string, prop ckalkan.CertProp) (string, error)
	X509ExportCertificateFromStore(alias string) (string, error)

	HashSHA256(data []byte) ([]byte, error)
	HashGOST95(data []byte) ([]byte, error)
	Close() error
}

var _ Kalkan = (*Client)(nil)

var (
	ErrInit    = errors.New("unable to refer to KC_GetFunctionList")
	ErrHTTPCli = errors.New("http cli error")
)

type Client struct {
	log Logger
	kc  *ckalkan.Client
	o   Options
	mu  sync.Mutex
}

// NewClient возвращает клиента для работы с KC.
func NewClient(opts ...Option) (*Client, error) {
	o := Options{log: defaultLogger}
	o.setDefaults()

	for _, op := range opts {
		op(&o)
	}

	kc, err := ckalkan.NewClient()
	if err != nil {
		return nil, err
	}

	cli := &Client{
		log: o.log,
		kc:  kc,
		o:   o,
	}

	err = cli.kc.Init()
	if err != nil {
		cli.log.Error("kc init error: ", err)
		return nil, fmt.Errorf("%w: %s", ErrInit, err)
	}

	cli.kc.TSASetURL(cli.o.TSP)

	if cli.o.LoadCerts {
		if err := cli.LoadCerts(); err != nil {
			cli.log.Error("load remote CA certs error: ", err)
			return nil, err
		}
	}

	return cli, nil
}